CVE-2026-19757

Executive Summary

CVE-2026-19757 is an unauthenticated path traversal vulnerability in the File-Upload Controller component of Dromara lamp-cloud, affecting all versions up to and including 5.10.0. The vulnerability resides in FileAnyoneController.java, where manipulation of the bucket and bizType arguments allows an attacker to traverse the filesystem path and potentially read, write, or overwrite files outside the intended upload directory. With a CVSS score of 7.3 (High), the flaw is remotely exploitable without authentication and has a public exploit, yet the vendor has not responded to early disclosure, leaving the entire affected version line exposed. This report provides technical analysis, detection artifacts, and mitigation guidance for enterprise teams running lamp-cloud deployments.

Technical Analysis

The vulnerable code is located in FileAnyoneController.java, a controller class within the lamp-cloud microservices framework. The NVD description explicitly states that manipulation of the bucket and bizType arguments results in path traversal (CWE-22). This indicates that the application constructs filesystem paths by concatenating user-supplied values from these two parameters without adequate sanitization or validation.

Vulnerability Mechanism:

The File-Upload Controller is a public-facing endpoint that accepts file upload requests. When a client submits a request, the controller extracts the bucket and bizType parameters and uses them to construct the storage path on the local filesystem. For example, a typical implementation might construct a path like:

/storage_root/{bucket}/{bizType}/{filename}

By injecting directory traversal sequences (e.g., ../) into the bucket or bizType arguments, an attacker can escape the intended storage root directory. If the application concatenates these values into a filesystem path without canonicalization or validation of .. sequences, the resulting path can point to any directory accessible by the service account running the application.

Attack Surface:

• The vulnerable endpoint is exposed via the FileAnyoneController, which by its name suggests it is intended for "anyone" — i.e., unauthenticated or low-privilege access.
• Network-facing deployment: The attack is remotely initiated, meaning the endpoint is exposed on the network.
• No authentication is required per the CVSS vector (PR:N), indicating the endpoint does not enforce authentication checks.

Affected Technical Details:

• The dangerous parameters are bucket and bizType, both of which appear to be directly incorporated into filesystem path operations.
• The vulnerability class is relative path traversal (CWE-22), which encompasses both read and write primitive abuse depending on the controller's functionality.
• Since this is a file upload controller, the likely impact is arbitrary file write (upload to arbitrary directories) and potentially arbitrary file read (if the controller supports listing or retrieval of previously uploaded files based on the same path construction logic).

Contrast with Secure Implementation:

A secure controller would use path canonicalization, validate that the resolved absolute path stays within an allowed root directory, and reject any input containing .. sequences or absolute path components. Additionally, parameter allow-listing for bizType values and a fixed whitelist for bucket values would reduce the attack surface. The absence of these measures in lamp-cloud up to 5.10.0 is the root cause of this vulnerability.

Vendor Status:

The project was informed of the issue through an early issue report but has not responded. There is no patch evidence from any tracked source, no advisory, and no fixed version released. The vulnerability is thus considered unpatched with patch confidence 0/4.

Exploitation Scenarios

Prerequisite: The lamp-cloud File-Upload Controller endpoint must be reachable from the network. In typical microservices deployments, this is usually exposed via an API gateway or direct service port.

Step 1 — Reconnaissance and Target Identification:

An attacker first identifies lamp-cloud instances. This may be accomplished via:

• Shodan/Censys searches for lamp-cloud banners or Spring Boot actuator endpoints that reveal framework details.
• Scanning for the specific controller path (e.g., /file/anyone or similar endpoints commonly present in Spring-based upload controllers).
• Reviewing the application's HTTP responses for headers like X-Application-Context or Spring Boot error pages that reveal framework and version.
• Public exploit publication suggests the vulnerability details have circulated, enabling threat actors to quickly identify and target vulnerable instances at scale.

Step 2 — Triggering the Vulnerability:

Once a lamp-cloud instance is identified, the attacker crafts a request to the File-Upload Controller. The request would include HTTP parameters or path variables for bucket and bizType. The manipulation involves injecting path traversal sequences, for example:

• bucket = ../../../../etc
• bizType = passwd (or any arbitrary value)

Or alternately, URL-encoded traversal patterns such as %2e%2e%2f to bypass weak input filters.

The controller then constructs a filesystem path using these unsanitized values. Because no path canonicalization is performed, the OS resolves the traversal sequence and the operation is performed against the resolved target path.

Step 3 — Payload Execution (Vulnerability-Class Level):

Since this is a file-upload controller, the exploitation depends on the endpoint's behavior:

• Arbitrary File Write: The attacker uploads a file (e.g., a web shell) and controls the bucket and bizType parameters to redirect the write to a directory within the web server's document root or any writable location accessible to the service account. For example, writing a JSP or PHP shell to the application's static resource directory would enable remote code execution when accessed via the web server.
• Arbitrary File Read (if supported): If the controller also implements file retrieval (e.g., downloading previously uploaded content), the attacker could set bucket and bizType to read sensitive system files such as /etc/passwd, application configuration files, database credentials, or private keys.

Step 4 — Post-Exploitation Impact:

• Remote Code Execution: By writing a web shell (e.g., shell.jsp or shell.php) into a directory served by the application, the attacker gains remote code execution on the host with the privileges of the application service account.
• Credential Theft: If arbitrary file read is possible, the attacker can exfiltrate configuration files containing database credentials, API keys, and other secrets, potentially leading to lateral movement within the infrastructure.
• Data Destruction: Arbitrary file write could also be used to overwrite critical application files, configuration files, or logs, leading to denial-of-service or system instability.
• Lateral Movement: Compromised credentials or file access can be leveraged to pivot to connected systems, databases, and internal services.

Exploit Availability: The NVD description states that the exploit has been made public. This means weaponized PoC or at minimum detailed exploitation steps are available, reducing the skill barrier for opportunistic attackers. The public nature of the exploit combined with the unpatched status makes this a high-probability target for exploitation in the wild.

Impact Assessment

CVSS Analysis (7.3 High):

• AV:N — Network exploitable, no physical or logical access required.
• AC:L — No special conditions or race conditions required; the attack is straightforward.
• PR:N — No privileges required; unauthenticated remote exploitation.
• UI:N — No user interaction required.
• C:L — Low confidentiality impact: limited file read capability or exposure of system files.
• I:L — Low integrity impact: ability to modify files within the service account's permissions.
• A:L — Low availability impact: potential to disrupt file storage functionality.

While the individual CIA subscores are "Low," the combination with network exploitability and no privileges elevates the severity to High (7.3). It is important to note that the "Low" scores assume the service account runs with least privileges; if the application runs with elevated privileges (e.g., root or SYSTEM), the actual impact would be significantly higher, potentially enabling full system compromise.

Affected Systems:

• All Dromara lamp-cloud deployments up to and including version 5.10.0.
• The vulnerability affects the File-Upload Controller component, which is present in any deployment where the controller is enabled and exposed.
• Microservices environments using lamp-cloud as an internal or external service are at risk.

Blast Radius:

• The immediate compromise is confined to the host running the vulnerable instance, but lateral movement via stolen credentials or file access can expand the blast radius to the entire cloud environment.
• Given the unpatched status and public exploit, the window of exposure is open-ended, and enterprise deployments should treat this as an active threat.

Business Impact:

• Confidentiality: Exposure of sensitive configuration, database credentials, or user data stored on the host filesystem.
• Integrity: Unauthorized modification or deletion of files, potential injection of malicious code/web shells.
• Availability: Overwriting critical application files could cause service degradation or outage.
• Compliance: If the compromised system stores regulated data (PII, financial, health), the organization may face regulatory fines and reporting requirements.

Detection Guidance

The detection artifacts below are designed to identify exploitation attempts of the path traversal in the bucket and bizType parameters of the File-Upload Controller.

Sigma Rule

title: Dromara lamp-cloud File-Upload Path Traversal Attempt
id: 3f77a9b2-6d4c-4a5b-9d1f-8b2b6a0c3e42
status: experimental
description: Detects path traversal attempts in bucket or bizType parameters targeting the FileAnyoneController in lamp-cloud
references:
    - CVE-2026-19757
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026.19757
    - cwe.22
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-query|contains:
            - 'bucket='
            - 'bizType='
        cs-uri-query|contains|all:
            - '..'
            - '%2e%2e'
            - '%252e%252e'
    condition: selection
falsepositives:
    - Legitimate use of directories containing dots in names
    - Curl or scripted HTTP clients testing path traversal
fields:
    - clientip
    - cs-uri-stem
    - cs-uri-query
level: high

YARA Rule

rule lamp_cloud_path_traversal {
    meta:
        author = "ValterSIT Threat Intel"
        description = "Detects path traversal payloads in HTTP requests targeting lamp-cloud FileAnyoneController"
        cve = "CVE-2026-19757"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19757"
        date = "2026-01-01"
        severity = "high"

    strings:
        $traversal1 = "bucket=" ascii wide
        $traversal2 = "bizType=" ascii wide
        $dotdot1 = "../" ascii wide
        $dotdot2 = "..\\" ascii wide
        $encoded1 = "%2e%2e%2f" ascii wide
        $encoded2 = "%252e%252e%252f" ascii wide
        $encoded3 = "..%2f" ascii wide

    condition:
        (any of ($traversal*) and any of ($dotdot*)) or
        (any of ($traversal*) and any of ($encoded*))
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-19757 - Dromara lamp-cloud FileAnyoneController Path Traversal Attempt";
    flow:established,to_server;
    http.uri;
    content:"bucket="; http.uri; nocase;
    content:"bizType="; http.uri; nocase;
    content:".."; http.uri;
    distance:0;
    pcre:"/buck(e)t=.*?(?:\.\.\/|%2e%2e%2f|%252e%252e%252f|\.\.\\\\)|bizType=.*?(?:\.\.\/|%2e%2e%2f|%252e%252e%252f|\.\.\\\\)/i";
    classtype:attempted-admin;
    reference:cve,CVE-2026-19757;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-19757;
    sid:10019757;
    rev:1;
)

Elastic Detection

rule:
  name: "Lamp-Cloud FileAnyoneController Path Traversal"
  severity: critical
  category: "Web Application Attack"
  tags:
    - "CVE-2026-19757"
    - "T1190"
    - "CWE-22"
  eql:
    sequence by source.ip with maxspan=5s
      [ http where url.path == "*file*" and url.query contains "bucket=" ]
      [ http where url.path == "*file*" and url.query contains "bizType=" ]
      [ http where url.query contains ".." or url.query contains "%2e%2e" or url.query contains "%252e%252e" ]

Splunk SPL Query

index=web earliest=-7d latest=now
| search uri_path="*file*" OR uri_query="*bucket=*" OR uri_query="*bizType=*"
| search uri_query IN ("*..*", "*%2e%2e*", "*%252e%252e*")
| rex field=uri_query "bucket=(?<bucket_value>[^&]+)"
| rex field=uri_query "bizType=(?<bizType_value>[^&]+)"
| where match(bucket_value, "(\.\.|%2e%2e|%252e%252e)") OR match(bizType_value, "(\.\.|%2e%2e|%252e%252e)")
| table _time, src_ip, dest_ip, uri_path, uri_query, http_method, status
| sort - _time

Wazuh OSSEC Rule

<group name="endpoint_security,lamp-cloud,">
  <rule id="550677" level="10">
    <if_sid>100024</if_sid> <!-- Basic web access rule -->
    <field name="url">\S*\?.*(bucket|bizType)=</field>
    <description>CVE-2026-19757: Potential path traversal in lamp-cloud FileAnyoneController (bucket/bizType parameters)</description>
    <regex>url: .*(\.\.|%2e%2e|%252e%252e)|.*(bucket|bizType).*</regex>
    <group>web_application_attack,t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info>CVE-2026-19757</info>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. The vendor (Dromara) has not responded to the initial disclosure issue report, and no patch, advisory, or fixed version exists in any tracked source. Do not assume a fix is imminent; plan for extended exposure.

1. Immediate Mitigations (No Patch Available)

• Disable or restrict access to the File-Upload Controller endpoint if it is not business-critical. Place it behind network-level access controls (firewall rules, security groups) that only allow trusted IPs.
• Deploy a WAF (Web Application Firewall) with rules to block path traversal patterns (.., %2e%2e, double URL encoding variants) specifically in bucket and bizType parameters.
• Reverse proxy filtering: If a reverse proxy (Nginx, HAProxy, AWS ALB) fronts the application, add request filtering rules to reject any URI containing traversal sequences in these parameters.
• Input validation at the application layer (temporary code patch): If source code is accessible, add validation to reject any bucket or bizType value containing .., %2e, or absolute path indicators. If deployment is from pre-built binaries, this requires source modification and rebuild.
• Network segmentation: Isolate the lamp-cloud service in a dedicated network segment with restricted egress to prevent lateral movement in case of compromise.
• Run service with least privilege: Ensure the application service account has minimal filesystem permissions. This limits the impact of file write operations to directories the account can access.

2. Patch/Upgrade Steps

• Monitor vendor repository and issue tracker (e.g., GitHub) for the dromara/lamp-cloud project for notifications of a fix or response to the disclosure issue report.
• Subscribe to Dromara security advisories and community channels for patch announcements.
• When a patch or patched version >5.10.0 is released, upgrade the lamp-cloud deployment immediately. Validate the fix by retesting the bucket and bizType parameters with traversal payloads.
• If no patch is forthcoming, consider adopting an alternative file storage solution or forking the project with a hardened controller implementation.

3. Long-Term Hardening

• Replace unauthenticated file upload endpoints with authenticated variants. The "Anyone" naming suggests the endpoint was designed without authentication; consider introducing OAuth2/JWT validation for all upload operations.
• Implement path canonicalization and validation in any file storage or retrieval logic. Use a secure path-building library that rejects any resolved path outside a predefined root directory.
• Adopt a microservices security baseline: ensure all services use defense-in-depth: network policies, service mesh mTLS, and per-service authorization.
• Integrate static code analysis (SAST) into the build pipeline to catch common path traversal and injection flaws before release.
• Establish a vulnerability disclosure process so that reported flaws receive prompt attention; the lack of vendor response here directly contributed to this vulnerability remaining unpatched with a public exploit.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-19757
2. CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
3. MITRE ATT&CK — T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
4. Dromara lamp-cloud project repository (monitor for fixes): https://github.com/dromara/lamp-cloud
5. CISA KEV Catalog: Not listed (confirmed not in KEV as of report date)

No specific threat actor campaigns or confirmed in-the-wild exploitation have been attributed to CVE-2026-19757 at present; however, the existence of a public exploit combined with the unpatched status and network-exposed attack surface makes active exploitation likely. The report will be updated as vendor response or threat intelligence regarding exploitation becomes available.